Privacy Policy
Version: 2026-06-24 Effective date: 24 June 2026
This Privacy Policy explains what personal data WebFunnelWatch collects, why, who we share it with, and the rights you have. WebFunnelWatch is a business-to-business service, so most personal data we handle is the work contact and account information of the professionals who use it.
1. Who we are and how to contact us
WebFunnelWatch is operated by Growth Systems Ltd, a company registered in England and Wales (company number 17296140), registered office at The Fisheries, 1 Mentmore Terrace, London, E8 3PN, United Kingdom. "WebFunnelWatch" is a trading name of Growth Systems Ltd.
For any privacy question or to exercise your rights, contact us at support@webfunnelwatch.com.
Growth Systems Ltd is the data controller for the personal data described in this policy.
2. The personal data we collect
We deliberately collect relatively little personal data. Specifically:
Account and identity data
Your email address and the authentication identifiers used to sign you in — including an authentication user ID from our auth provider and, if you choose to sign in with Google, your Google account identifier. If you use a password, it is handled and stored in hashed form by our authentication provider; we do not see or store your password. If you sign in with Google or a magic link, no password is involved.
Consent records
A record of which version of our Terms and Privacy Policy you accepted and when, and whether you opted in to marketing email and when. These records are timestamped and stored so we can demonstrate the choices you made.
Product and usage data
The funnels you choose to track, your projects, personas, the crawl runs you trigger, and the intelligence derived for you. Please note: the content that the Service crawls is the publicly available marketing funnels of the companies you choose to monitor — it is not your personal data, and in the ordinary case it is not the personal data of any individual.
Technical data
Your IP address (used for sign-up rate-limiting and abuse prevention), basic device and browser information, and product analytics events (see section 6 on cookies and analytics).
Email engagement data
Delivery and engagement information relating to transactional emails and, if you have opted in, marketing emails, handled through our email provider.
Billing data
If you buy a paid plan, we hold limited billing information such as your billing email, the plan you are on, and your payment status and history. Payments are processed by Stripe; your full payment card details are handled by Stripe and are not stored by us.
What we do not collect
We do not store your full payment card details (these are held by our payment processor, Stripe). We do not collect special-category data, and the Service is not directed at children.
3. Why we use your data and our legal bases
Under UK GDPR and EU GDPR we must have a legal basis for using your personal data. Our bases are:
| What we do | Legal basis |
|---|---|
| Provide the Service to you and your organisation | Performance of a contract |
| Authenticate you, secure accounts, prevent abuse, and rate-limit sign-ups | Legitimate interests (keeping the Service secure) and performance of a contract |
| Send transactional emails (verification, password reset, magic links) | Performance of a contract |
| Send marketing emails | Consent (opt-in only — see section 4) |
| Process payments and manage paid subscriptions | Performance of a contract |
| Measure and improve the Service through analytics | Consent (for non-essential analytics cookies — see section 6) |
| Keep records to meet legal obligations | Legal obligation |
Where we rely on legitimate interests, we have considered your rights and interests and believe our use is proportionate. You can object — see section 8.
4. Marketing and consent
When you sign up, we ask for two separate consents:
1. Acceptance of our Terms and Privacy Policy — this is required to create an account. The box is unticked by default and you cannot sign up without ticking it. 2. Marketing email — this is entirely optional. The box is unticked by default. We never pre-tick it.
If you opt in to marketing email, you can withdraw your consent at any time — it is as easy to withdraw as it was to give. You can change your marketing preference in your account settings, or use the unsubscribe link in any marketing email. Withdrawing consent does not affect transactional emails we need to send to operate your account.
5. Who we share your data with (sub-processors)
We use a small number of trusted third-party providers to run the Service. Each processes personal data on our behalf under a data-processing agreement. They are:
| Provider | What they do | Where data is processed |
|---|---|---|
| Supabase | Authentication and primary application database | United States (us-east-1) |
| DigitalOcean | Application hosting (backend server) | See current sub-processor list |
| Cloudflare | DNS and object storage (R2) for funnel screenshots | See current sub-processor list |
| Resend | Transactional and marketing email | Sending region in the EU; provider is US-based |
| Stripe | Payment processing and subscription billing | UK/EU and United States (Stripe Payments UK Ltd and affiliates) |
| Google sign-in (OAuth) and AI processing (Gemini API) in the crawl/analysis pipeline | United States | |
| Anthropic | AI processing (Claude API) in the analysis pipeline | United States |
| Google Analytics (GA4) | Product and marketing analytics | United States |
We keep this list current. We do not sell your personal data, and we do not share it with third parties for their own marketing.
Note on AI processing: content collected by the Service is processed by third-party AI tools (for example, Gemini and Claude) to interpret and summarise it. This processing is part of how the Service produces intelligence.
6. Cookies and analytics
Our marketing site and app use Google Analytics 4 (GA4) to understand how the Service is used so we can improve it. GA4 sets analytics cookies, which are non-essential. Under the UK Privacy and Electronic Communications Regulations (PECR) and GDPR, non-essential cookies require your prior consent.
We therefore ask for your consent through a cookie banner before any non-essential analytics cookies are set. You can accept or reject non-essential cookies, and you can change your choice at any time. Strictly necessary cookies (for example, those needed to keep you signed in) do not require consent and are always active.
Full details of the specific cookies we use are in our Cookie Policy.
Marketing emails we send include the sender's identity and a clear unsubscribe option, as required by PECR.
7. International data transfers
We are a UK company, but several of our providers process data in the United States (see section 5). This means your personal data — primarily your email and account identity — may be transferred to and stored in the US.
When we transfer personal data outside the UK or EEA, we rely on legally recognised safeguards, which may include the UK International Data Transfer Agreement (IDTA) or Addendum, the EU Standard Contractual Clauses (SCCs), and the EU-US Data Privacy Framework together with its UK extension, as applicable to each provider. You can ask us for more detail about the safeguard relied on for a particular provider by contacting support@webfunnelwatch.com.
8. Your rights
Under UK and EU data-protection law you have the right to:
- access the personal data we hold about you;
- rectify inaccurate data;
- erase your data ("right to be forgotten");
- restrict or object to our processing;
- data portability — receive your data in a portable format;
- withdraw consent at any time, where we rely on consent; and
- complain to a supervisory authority.
Deleting your account is self-serve. You can delete your account at any time in your account settings. When you do, we permanently delete your account and associated data from both our authentication system and our application database — this is a real deletion, not a soft delete — subject to the retention periods in section 9.
To exercise any other right, email support@webfunnelwatch.com. We will respond within the time limits set by law (normally one month).
If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, or to your local data-protection authority if you are in the EU.
9. How long we keep your data
We keep personal data only as long as we need it. Our retention schedule:
| Data | How long we keep it |
|---|---|
| Account and identity data | Until you delete your account; then erased, with backups purged within 30 days |
| Funnels, projects, crawl runs, and intelligence | While your account is active; deleted when you delete your account |
| Consent records (Terms accepted, marketing opt-in, timestamps) | 6 years after account closure, so we can evidence the consents given |
| Analytics data (GA4) | 14 months |
| Email engagement data | While you are subscribed, and for a short period after you unsubscribe |
| Billing and financial records | 6 years, as required by UK tax law |
Where the law requires us to keep certain records (for example, financial records), that requirement overrides a deletion request for those specific records.
10. Security
We take reasonable technical and organisational measures to protect your data, including encryption in transit, access controls, and using reputable providers that maintain their own security standards. No system is perfectly secure, but we work to protect your data and to respond appropriately if something goes wrong.
11. Information for users in the United States (including California)
If you are in the United States, the following applies in addition to the rest of this policy.
We collect the categories of personal information described in section 2 (identifiers such as email and account IDs, internet activity such as analytics and IP address, and commercial/usage information relating to your use of the Service). We use it for the business purposes described in section 3, and we share it only with the service providers listed in section 5.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
If you are a California resident, you have the right to know what personal information we collect and how we use it, the right to request deletion, the right to correct inaccurate information, and the right not to be discriminated against for exercising your rights. You can exercise these rights — including deleting your account yourself — as described in section 8, or by emailing support@webfunnelwatch.com.
12. Changes to this policy
We may update this policy from time to time. When we make material changes, we will update the version identifier and effective date above and take reasonable steps to notify you. We encourage you to review it periodically.
WebFunnelWatch is a trading name of Growth Systems Ltd, registered in England and Wales, company number 17296140. Registered office: The Fisheries, 1 Mentmore Terrace, London, E8 3PN, United Kingdom.